CVE-2026-64202: NI LabVIEW RCE Vulnerability

CVE-2026-64202 Overview

CVE-2026-64202 is a memory corruption vulnerability in NI LabVIEW that can lead to information disclosure or arbitrary code execution. The flaw affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions. Exploitation requires a user to open a specially crafted Virtual Instrument (VI) file, making this a client-side attack that relies on user interaction. The underlying weakness is classified as an out-of-bounds read [CWE-125]. LabVIEW is widely deployed in industrial automation, test and measurement, and research environments, which increases the operational risk of successful exploitation on engineering workstations.

Critical Impact
Attackers who convince a user to open a malicious VI file can read process memory or execute arbitrary code in the context of the LabVIEW user.

Affected Products

NI LabVIEW 2026 Q3 (26.3.0)
All NI LabVIEW versions prior to 2026 Q3
Engineering workstations running vulnerable LabVIEW installations

Discovery Timeline

2026-08-25 - CVE-2026-64202 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-64202

Vulnerability Analysis

The vulnerability is a memory corruption issue triggered when LabVIEW parses a crafted VI file. The weakness is categorized as an out-of-bounds read [CWE-125], which allows the process to access memory outside the intended buffer boundaries. Depending on the memory layout at the time of parsing, this behavior can leak sensitive process memory or corrupt program state to redirect execution flow. The attack vector is local and requires user interaction, but the impact spans confidentiality, integrity, and availability of the affected host.

Root Cause

The root cause lies in improper bounds checking during deserialization of structures embedded in VI files. LabVIEW consumes VI files as complex binary containers holding block diagrams, front panel data, and compiled code fragments. When a field length or offset in the file is not validated against the actual buffer size, the parser reads past the allocated region. This condition satisfies the classic pattern of [CWE-125] out-of-bounds read and can be chained with additional primitives for arbitrary code execution.

Attack Vector

An attacker crafts a malicious VI file and delivers it to a LabVIEW user through email, shared engineering repositories, project bundles, or removable media. Opening the file in a vulnerable LabVIEW version triggers the parsing flaw. No authentication or network access is required. The attacker gains code execution under the privileges of the LabVIEW user, which on engineering workstations frequently includes administrative rights and access to test infrastructure. See the NI LabVIEW Memory Vulnerability Advisory for vendor details.

Detection Methods for CVE-2026-64202

Indicators of Compromise

Unexpected LabVIEW process crashes or exception dialogs when opening .vi files from external sources
LabVIEW spawning child processes such as cmd.exe, powershell.exe, or scripting hosts
VI files arriving from untrusted email attachments, chat platforms, or unmanaged file shares
Outbound network connections initiated by LabVIEW.exe shortly after opening a project or VI

Detection Strategies

Monitor process creation events where LabVIEW.exe is the parent of shell, scripting, or living-off-the-land binaries
Alert on module loads or DLL side-loading events originating from user-writable directories under the LabVIEW process
Baseline normal file access patterns for LabVIEW and flag anomalous reads of credential stores, browser data, or SSH keys

Monitoring Recommendations

Ingest endpoint telemetry from engineering and lab workstations into a centralized detection pipeline
Track LabVIEW version inventory across the fleet to identify hosts still running 26.3.0 or earlier
Enable crash reporting and Windows Error Reporting collection to surface exploitation attempts that fail

How to Mitigate CVE-2026-64202

Immediate Actions Required

Upgrade NI LabVIEW to the fixed version identified in the NI LabVIEW Memory Vulnerability Advisory
Restrict opening of VI files originating from untrusted sources on engineering workstations
Enforce least privilege for LabVIEW users and remove local administrator rights where feasible
Apply application allowlisting to block unauthorized child processes spawned by LabVIEW.exe

Patch Information

NI has published guidance and remediation instructions in its security advisory. Administrators should consult the NI LabVIEW Memory Vulnerability Advisory for the corrected version and applicable patches for supported LabVIEW releases.

Workarounds

Only open VI files from verified internal repositories and trusted collaborators
Use file reputation and attachment sandboxing to inspect .vi files before delivery to end users
Segment engineering workstations from production networks to contain post-exploitation activity
Disable auto-open of LabVIEW project files from network shares and email clients

bash

# Configuration example: block LabVIEW from spawning common living-off-the-land binaries
# Windows Defender Application Control / AppLocker rule concept
New-AppLockerPolicy -RuleType Deny \
  -User "Everyone" \
  -Path "C:\\Windows\\System32\\cmd.exe" \
  -Condition "ParentProcess=LabVIEW.exe"